Add session transfer for SSO cookies on custom domains

After OIDC login, if the redirect targets a trust center custom
domain, the callback now redirects through a session-transfer
endpoint on that domain. The endpoint verifies an HMAC-signed,
time-limited token and sets the session cookie on the custom
domain before redirecting to the final URL.

The continue URL is bound into the signed token payload to
prevent open-redirect attacks via parameter tampering.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/server/api/authn/session_transfer.go

@@ -0,0 +1,116 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package authn
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+)
+
+const sessionTransferTTL = 60 * time.Second
+
+var (
+	ErrInvalidSessionTransferToken = errors.New("invalid session transfer token")
+	ErrSessionTransferTokenExpired = errors.New("session transfer token expired")
+)
+
+// SignSessionTransfer creates a signed, time-limited token containing a
+// session ID and the intended redirect URL. The token format is
+// base64(sessionID:continueURL:timestamp).signature.
+func SignSessionTransfer(sessionID string, continueURL string, secret string) (string, error) {
+	if secret == "" {
+		return "", fmt.Errorf("cannot sign session transfer token: secret is empty")
+	}
+
+	payload := sessionID + ":" + continueURL + ":" + strconv.FormatInt(time.Now().Unix(), 10)
+	encoded := base64.RawURLEncoding.EncodeToString([]byte(payload))
+
+	mac := hmac.New(sha256.New, []byte(secret))
+	mac.Write([]byte(encoded))
+	sig := base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
+
+	return encoded + "." + sig, nil
+}
+
+// SessionTransferClaims holds the verified claims from a session transfer
+// token.
+type SessionTransferClaims struct {
+	SessionID   string
+	ContinueURL string
+}
+
+// VerifySessionTransfer verifies a session transfer token and returns
+// the session ID and continue URL if the token is valid and not expired.
+func VerifySessionTransfer(token string, secret string) (SessionTransferClaims, error) {
+	if secret == "" {
+		return SessionTransferClaims{}, fmt.Errorf("cannot verify session transfer token: secret is empty")
+	}
+
+	parts := strings.SplitN(token, ".", 2)
+	if len(parts) != 2 {
+		return SessionTransferClaims{}, ErrInvalidSessionTransferToken
+	}
+
+	encoded, sig := parts[0], parts[1]
+
+	mac := hmac.New(sha256.New, []byte(secret))
+	mac.Write([]byte(encoded))
+	expectedSig := base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
+
+	if !hmac.Equal([]byte(sig), []byte(expectedSig)) {
+		return SessionTransferClaims{}, ErrInvalidSessionTransferToken
+	}
+
+	payload, err := base64.RawURLEncoding.DecodeString(encoded)
+	if err != nil {
+		return SessionTransferClaims{}, ErrInvalidSessionTransferToken
+	}
+
+	// Payload format: sessionID:continueURL:timestamp
+	// Use LastIndex to find the timestamp separator (timestamp is always last).
+	idx := strings.LastIndex(string(payload), ":")
+	if idx < 0 {
+		return SessionTransferClaims{}, ErrInvalidSessionTransferToken
+	}
+
+	tsStr := string(payload[idx+1:])
+	rest := string(payload[:idx])
+
+	ts, err := strconv.ParseInt(tsStr, 10, 64)
+	if err != nil {
+		return SessionTransferClaims{}, ErrInvalidSessionTransferToken
+	}
+
+	if time.Since(time.Unix(ts, 0)) > sessionTransferTTL {
+		return SessionTransferClaims{}, ErrSessionTransferTokenExpired
+	}
+
+	// Split rest into sessionID and continueURL.
+	sepIdx := strings.Index(rest, ":")
+	if sepIdx < 0 {
+		return SessionTransferClaims{}, ErrInvalidSessionTransferToken
+	}
+
+	return SessionTransferClaims{
+		SessionID:   rest[:sepIdx],
+		ContinueURL: rest[sepIdx+1:],
+	}, nil
+}

pkg/server/api/authn/session_transfer_test.go

@@ -0,0 +1,73 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package authn
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSignAndVerifySessionTransfer(t *testing.T) {
+	t.Parallel()
+
+	secret := "test-secret-key"
+	sessionID := "ses_abc123"
+	continueURL := "https://custom.example.com/compliance"
+
+	token, err := SignSessionTransfer(sessionID, continueURL, secret)
+	require.NoError(t, err)
+	require.NotEmpty(t, token)
+
+	claims, err := VerifySessionTransfer(token, secret)
+	require.NoError(t, err)
+	assert.Equal(t, sessionID, claims.SessionID)
+	assert.Equal(t, continueURL, claims.ContinueURL)
+}
+
+func TestVerifySessionTransfer_WrongSecret(t *testing.T) {
+	t.Parallel()
+
+	token, err := SignSessionTransfer("ses_abc123", "https://example.com", "secret-a")
+	require.NoError(t, err)
+
+	_, err = VerifySessionTransfer(token, "secret-b")
+	assert.ErrorIs(t, err, ErrInvalidSessionTransferToken)
+}
+
+func TestVerifySessionTransfer_TamperedToken(t *testing.T) {
+	t.Parallel()
+
+	token, err := SignSessionTransfer("ses_abc123", "https://example.com", "secret")
+	require.NoError(t, err)
+
+	_, err = VerifySessionTransfer(token+"x", "secret")
+	assert.ErrorIs(t, err, ErrInvalidSessionTransferToken)
+}
+
+func TestVerifySessionTransfer_MalformedToken(t *testing.T) {
+	t.Parallel()
+
+	_, err := VerifySessionTransfer("not-a-valid-token", "secret")
+	assert.ErrorIs(t, err, ErrInvalidSessionTransferToken)
+}
+
+func TestSignSessionTransfer_EmptySecret(t *testing.T) {
+	t.Parallel()
+
+	_, err := SignSessionTransfer("ses_abc123", "https://example.com", "")
+	assert.Error(t, err)
+}